Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.5
CVE-2026-123870: Otterdog webapp can run attacker code when webhook secret missing
CVE-2026-123870 · published today
Summary
If the GITHUB_WEBHOOK_SECRET setting is not configured, the Otterdog service will accept any GitHub webhook and pass its contents to a Python eval function. This lets an unauthenticated user send specially crafted data that runs arbitrary code on the server hosting Otterdog. Set a strong webhook secret (or upgrade to a version that removes the unsafe eval) to stop the issue.
What to do
- Update eclipse foundation otterdog to version 1.3.2 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| eclipse foundation | otterdog | < 1.3.2 |
Original advisory text
[Eclipse CSI - otterdog] Unauthenticated remote code execution via eval() on format-string-injected webhook body when GITHUB_WEBHOOK_SECRET is unset
The otterdog webapp evaluates a format-string built from the incoming GitHub webhook JSON body using Python's eval(). When the GITHUB_WEBHOOK_SECRET configuration value is unset or empty (the code default is None), the HMAC signature check is skipped entirely, allowing an unauthenticated network client to reach the eval() sink with attacker-controlled input and execute arbitrary Python on the webapp host.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Timeline
Published9 Nov 2026
Updated9 Nov 2026
First seen9 Nov 2026
Track software like this
Free during beta